The WhatsApp API
that doesn't drop.
Send OTPs, notifications and automations over HTTP. Number redundancy with failover, signed webhooks, SDKs in several languages and a playground. Get started in minutes on the Free plan — no card.
No credit card · free forever plan · 2 numbers with redundancy
# send a message in 1 request
curl https://api.bzapper.com.br/messages/text \
-H "Authorization: Bearer bz_live_…" \
-d '{
"to": "+5551999998888",
"text": "Your code is 318204"
}'
# response
{
"message_id": "9d41…bbbd",
"status": "queued",
"number": "+5551999198087"
}From your first number to webhooks in three steps
Connect a number, call the API, receive the events. Integrated in minutes.
Connect a number
Connect from the dashboard. Redundancy across numbers turns on by itself.
Call the API
One POST and the message joins the queue, with per-number pacing.
Receive webhooks
Delivered, read, replied, number dropped — all signed and in real time.
Everything a serious product needs
From number redundancy to secure OTP, from webhooks to SDKs — built for production.
Multi-number redundancy
Several numbers per project, with automatic failover and health monitoring. One goes down, traffic keeps flowing.
Secure OTP
Code in a separate message, never persisted or displayed — not in history, not in the inbox.
Signed webhooks
Real-time events with HMAC-SHA256, retry and dedup. Local relay, `stripe listen` style.
Multi-language SDKs
Node, Python, PHP, .NET (C#), Java, Go and Ruby — aligned with the OpenAPI spec and tested by the same conformance suite. Copy, paste and run.
Unified inbox
Conversations unified per contact even when the sending number changes. Own echo and group context.
Private media
Files in a private bucket, fetched via pre-signed URL — the client downloads directly, never through your API.
Projects & multi-user
Isolate environments per project, invite the team, control by key and scope.
API playground
Test any endpoint and inspect webhooks live, straight from the dashboard.
What nobody else ships
This is not a feature list — it is what you will not find in any other WhatsApp gateway. Every item below is a real endpoint, in production, covered by all 7 SDKs.
Numbers that take turns on their own
Several numbers per project with automatic failover, health monitoring and conversation affinity: your customer keeps talking to the same sender even when traffic switches numbers underneath.
Anti-ban autopilot for campaigns
Human-like pacing, per-number caps, time windows, rotation, gradual warm-up and an automatic pause at the first sign of a block. An anti-ban specialist built into the product.
A widget you embed in YOUR product
One line of HTML and your customers connect, disconnect and watch their own numbers inside your system. You build no screens at all.
Connect for partner software
Your customer creates the account, subscribes to Pro and connects WhatsApp without leaving your screen — and your backend receives their API key. You never touch billing.
A real Idempotency-Key
Repeated the POST after a timeout or a retry? The message goes out once and you get the same response back. The standard Stripe made famous, absent from every other WhatsApp gateway.
Edit and revoke after sending
Typo in a delivered message? PATCH fixes it. Sent to the wrong person? DELETE removes it for everyone — all over the API, without touching a phone.
Check the list before spending sends
One POST tells you which numbers on your list actually have WhatsApp. Clean the list before the campaign instead of finding out while burning your number reputation.
Presence and calls over the API
Real “typing…” and “recording audio…”, groups included — your bot stops sounding like a robot. And an incoming call on the number? Rejected automatically over the API.
Stable error codes in 6 languages
Every error carries a neutral code that never changes (branch on it) plus a message already translated for your end user. Never parse an error string again.
The API warns your integration
When something changes, bZapper fires an advisory segmented by SDK, by version and by the features you actually use — in the panel and in the API itself. You do not find out by breaking.
A dedicated IP per number
Each number can go out through its own proxy. Real network isolation between your customers or environments — not one shared box for everybody.
One identity across every number
Set the project’s About and identity once, then apply it to EVERY connected number in a single POST. The same brand on each number, with no manual work.
7 official SDKs, generated from one spec
Node, Python, PHP, .NET (C#), Java, Go and Ruby — all aligned to the same OpenAPI and cleared by the same conformance suite on every release. No competitor comes close.
One REST API. All of WhatsApp.
From OTP to signed webhooks, from groups to the unified inbox — every capability below is a real endpoint, covered by all 7 SDKs.
Messaging
- 13 types in one REST API
- Forward, reply (quote) and mention
- Scheduled sending with scheduled_at
- OTP in a separate message, never persisted
Consent & compliance
- Automatic keyword opt-out
- Per-contact consent ledger
- Block and suppress via API
- Private media with pre-signed URLs
Contacts (CRM)
- Rich profile: document and address
- Tags, groups and auto-correlation
- Advanced filters + history and notes
- Opt-out, block and opt-in
Conversations & inbox
- Unified history per contact
- Archive, pin, mute and mark read
- Conversation labels
- Group context and own echo
WhatsApp groups
- Create and administer groups
- Participants: add, promote, remove
- Invite link and join by code
- Approve join requests
Numbers & instances
- Connect via QR or code
- White-label profile per number
- Per-number privacy settings
- Failover with health monitoring
Webhooks & realtime
- Webhooks signed with HMAC-SHA256
- Retry, dedup and auditable deliveries
- Live SSE stream (/stream)
- Local relay, stripe listen style
Embeddable widget
- Floating or embedded mode
- Your customers connect numbers
- Usage mini-dashboard
- Public key locked to origin
Platform & dev
- SDKs in 7 languages + OpenAPI
- API playground in the panel
- Free/Pro plans + add-ons
- Usage, metrics and 6 languages
Every item above maps to a real API endpoint — no vaporware. Explore them all in the Playground.
Copy, paste, run.
Official SDKs, aligned with the OpenAPI spec and tested by the same conformance suite, in Node, Python, PHP, .NET (C#), Java, Go and Ruby. Signed webhooks with HMAC, retry and dedup. Local relay, stripe listen style, to test on your localhost.
$ npm install @bzapper/client $ pip install bzapper $ composer require bzapper/bzapper $ go get github.com/bernisoftware/bzapper-go $ br.com.bernisoftware:bzapper (Maven) $ dotnet add package Bzapper $ gem install bzapper Webhook events
# send an OTP
curl https://api.bzapper.com.br/messages/otp \
-H "Authorization: Bearer bz_live_…" \
-d '{"to":"+5551999998888","code":"318204"}'// npm install @bzapper/client
import { Bzapper } from '@bzapper/client';
const bz = new Bzapper({ apiKey: 'bz_live_…' });
await bz.sendOTP({ to: '+5551999998888', code: '318204' });# pip install bzapper
from bzapper import Client
bz = Client("bz_live_…")
bz.send_otp("+5551999998888", code="318204")// composer require bzapper/bzapper
$bz = new Client('bz_live_…');
$bz->sendOtp('+5551999998888', '318204');// go get github.com/bernisoftware/bzapper-go
import bzapper "github.com/bernisoftware/bzapper-go"
bz := bzapper.NewClient("bz_live_…")
bz.SendOTP("+5551999998888", "318204")// br.com.bernisoftware:bzapper
var bz = new BzapperClient("bz_live_…");
bz.sendOtp("+5551999998888", "318204");// dotnet add package Bzapper
using Bzapper;
using var bz = new BzapperClient("bz_live_…");
var msg = await bz.SendTextAsync(new SendText { To = "+5511999999999", Body = "Olá do bZapper!" });# gem install bzapper
require "bzapper"
client = Bzapper::Client.new("bz_live_…")
client.messages.send_text(to: "+5511999999999", body: "Olá do bZapper!")Put number management right inside your product
A standalone widget you embed in your own system. Your customers connect, disconnect and track the project numbers — with zero UI to build on your side. One line of code.
Project numbers
Automatically loads the connected numbers of the project tied to the key. Each one with live status.
Connect via QR
The customer scans the QR and connects a new number right there — add a number (if the plan allows) or disconnect, all inside the widget.
Mini dashboard
Project usage at a glance: messages, numbers and storage for the period. Billing stays in the panel.
Origin-locked
The wgt_ key is public, but locked to an origin allowlist (CORS). It never exposes your real API key.
Floating (plug-and-play)
A bubble in the corner of the screen. Just paste the <script> with your key — it opens with one click.
Embedded (inline)
Render <bzapper-widget> anywhere on your page, like a native block of your own dashboard.
Floating mode — one line in your HTML:
<!-- paste before </body> -->
<script src="https://widget.bzapper.com.br/v1/widget.js"
data-key="wgt_sua_chave" async></script>The wgt_ key is public (it ships in the HTML) and locked to an origin allowlist you configure in the panel. Your real API key never shows up. Billing (plans and invoices) stays in the panel — the widget only manages connections.
Offer WhatsApp inside your software
Your customer subscribes to bZapper Pro and connects their number without leaving your product. You receive the API key they authorized and start sending and receiving messages right away.
- 1
One-click account
The component opens with the details your product already has. No password, no captcha, no email confirmation.
- 2
Pro subscription
Card or Pix, right there. The customer pays bZapper directly — you never handle billing.
- 3
WhatsApp connected
QR code or pairing code, with live status. At the end, your backend receives the API key.
One line on the front end
Modal or inline, in Shadow DOM: it never clashes with your product’s CSS.
One webhook for all
Messages and status for all your customers on a single endpoint, tagged with your own customer id.
Automatic suspension
If the customer’s Pro goes unpaid, the key answers 402 and resumes by itself once they pay.
In all 7 SDKs
Node, Python, PHP, .NET (C#), Java, Go and Ruby already ship the partner client.
What your product needs to write:
// 1. your backend opens the session with the partner secret
const { session_token } = await api.post('/bzapper/session')
// 2. the customer subscribes and connects without leaving your screen
BzapperConnect.open({
session: session_token,
onComplete: ({ code }) => api.post('/bzapper/exchange', { code }),
})
// 3. your backend exchanges the code for the customer API key
// → { api_key: "bz_live_…", status: "active" }The partner secret and the API key stay on your backend. The browser gets a 30-minute ticket that only works on your domains. The partner key operates WhatsApp but never touches the customer’s plan, users or billing.
WhatsApp over an API, without interruption
Delivery is engineering. Every number in the project has its own volume limits, send pacing, continuous health monitoring and real-time alerts. When a number goes down, traffic keeps flowing through the others — with no action from you.
- Load spread across the numbers in the project
- Gradual volume ramp-up on newly connected numbers
- Conversations unified per contact, even when switching numbers
- Real-time alerts when a number goes down
A contact base that works for you
Every number you touch becomes a rich contact — with document, address, tags and history. Auto-correlated by project and number, filterable in seconds, and always under your consent ledger.
- Rich profile
Name, phone, email, document (tax ID) and a full address — city, state, ZIP and country.
- Tags & groups
Organize with tags and groups backed by their own dictionaries. A contact can belong to many — all versioned.
- Automatic correlation
Every contact is linked on its own to the project and the number it spoke through. No manual entry, no duplicates.
- Advanced filters
Query by status, tags (all or any), city, document, activity and dates — straight from the API or the panel.
- History & notes
An append-only timeline of every contact event, plus internal team notes. Nothing gets lost.
- Opt-out & block
Suppress or block with one POST. The status becomes opted_out or blocked and stops the send before queuing.
- OTP delivered and read · 2 min ago
- Linked to number +55 51 99919-8087
- Tag “pro-plan” added by you
- Opt-in recorded in the consent ledger
Contacts, tags, groups and suppressions live isolated per project — a key only sees its own project.
See the docs →Schedule delivery for the right moment
Send any message with a future timestamp. bZapper holds it and fires at the exact time — no cron on your server, no process to keep alive.
- Just one field
Add scheduled_at to any send — text, media, anything. Everything else is the same as a normal send.
- Number picked at send time
The healthy number is chosen at send time, not at scheduling — it never lands on a number that went offline.
- Cancel anytime
List and cancel pending schedules at any moment, via API or dashboard.
// schedule for 2 hours from now
POST /messages/text
{
"to": "+5511999990000",
"body": "Bom dia! ☀️",
"scheduled_at": "2026-07-01T09:00:00Z"
}Your contacts are your most valuable asset
A poorly kept contact base is expensive. That’s why protecting your base isn’t an extra — it’s how bZapper is built, from project isolation to the consent ledger.
We treat them as if they were ours: protected, isolated and under your control.
- Project isolation
Numbers, inbox, keys and suppression live in isolated projects. A key only sees its own project — nothing leaks between customers or environments.
- Private media with presign
Conversation files sit in a private bucket and only open via a short-lived pre-signed URL (24h by default). Nothing indexable, nothing loose.
- Native opt-out & suppression
Whoever replies STOP/SAIR/PARAR is suppressed automatically and never receives another send. The block list stops the send before queuing.
- Consent ledger
Every opt-in and opt-out lands in an append-only, timestamped and auditable ledger — the proof of legal basis the LGPD requires.
- Signed webhooks
Every event ships with an HMAC-SHA256 signature and timing-safe verification. The webhook secret is encrypted at rest.
- Encrypted secrets
WhatsApp sessions encrypted at rest and the OTP code never persisted nor displayed. Phone and email normalized in the database.
Contact suppressed in the project instantly and recorded in the consent ledger. Keyword opt-out also emits the contact.opted_out webhook.
bZapper is the data processor and handles the heavy privacy lifting; the legal basis for consent is your responsibility. We work together.
Read the Privacy & LGPD guide →You pay for numbers. Messages, unlimited.
What matters is never stopping delivery — and that means redundancy across numbers. Pick a plan, turn on recurring billing, and forget the invoice.
Free
Try the redundancy, no card.
- 2 numbers (redundancy active)
- 250 messages/month
- 1 project
- 100 MB of media
- 15 days of retention
- Failover · SDKs · webhooks
Pro
Everything unlimited. For production.
- 2 numbers (redundancy)
- UNLIMITED messages
- 1 project
- 1 GB of media
- 30 days of retention
- Uptime + alerts · priority
Grew? Add on the spot — prorated billing
Add-ons are a fraction of the Pro subscription. Added mid-month? You only pay the prorated amount until the next invoice.
Build your plan
Adjust the resources and see the total — just like at checkout.
💳 Save your card and turn on auto-renewal — uninterrupted access, zero worries.
Prices in BRL (Brazil). Americas in USD · other regions in EUR — set by your region.
What people use bZapper for
OTP / 2FA
Verification codes with varied text and tracked delivery.
Transactional notifications
Orders, invoices, reminders — straight from your backend.
Centralized support
Many numbers, one inbox, N agents.
Group bots
Watch mentions and attachments, reply in the right context.
Automation & no-code
Integrate with n8n, Make, Zapier via webhooks and HTTP.
Alerts and reminders
Confirmations, appointment reminders and operational alerts from your system.
Everything you want to know
Is this the official WhatsApp API?
No. bZapper sends over the <strong>multi-device protocol</strong>, with the number connected from the dashboard — that is how every message goes out today, and it is what you integrate against. A rail over Meta’s official Cloud API is in development, with no date.
How do you ensure delivery?
Each number has its own volume limits, send pacing and continuous health monitoring. When one goes down, the others take over and you get a real-time alert — and the conversation stays unified per contact.
How much does it cost?
Two simple plans. <strong>Free</strong> (free): 2 numbers with redundancy, 250 messages/month, 1 project, 100 MB and 15 days of retention — so you can try the redundancy without a card. <strong>Pro</strong> (R$ 79,90/month): 2 numbers, <strong>unlimited messages</strong>, 1 project, 1 GB and 30 days of retention. Need more? Add-ons are a fraction of the subscription — extra number, extra project, +GB of media, +retention — and adding mid-month means you only pay the prorated amount until the next invoice. In BRL in Brazil; Americas in USD, other regions in EUR. We recommend saving your card and enabling auto-renewal: uninterrupted access.
How long does it take to integrate?
Minutes. Create the account, generate an API key and use one of the SDKs (Node, Python, PHP, .NET, Java, Go, Ruby) or a raw POST. There is a playground and full documentation.
Do you have SDKs and webhooks?
Yes — SDKs in 7 languages, aligned with the OpenAPI spec and tested by the same conformance suite, webhooks signed with HMAC, retry/dedup and a local relay, `stripe listen` style, to test on localhost.
What about data privacy?
Conversation media goes to a private bucket with a pre-signed URL; the OTP code is never persisted; secrets are encrypted. Retention is configurable per account.
Start sending over WhatsApp in minutes
Create your free account, generate an API key and make your first send today. No card, no red tape.